CVE-2026-29812 Overview
CVE-2026-29812 affects CyberPanel versions before 2.4.4. The application does not log actions that could manipulate the child domains list. This gap in audit logging falls under [CWE-778] (Insufficient Logging). Authenticated users with low privileges can alter child domain configurations without leaving an audit trail, complicating incident response and forensic investigation.
The issue was fixed in CyberPanel 2.4.4 through a commit that also corrected the child domain enumeration logic in plogical/acl.py and websiteFunctions/website.py.
Critical Impact
Attackers or malicious tenants can modify the child domains list without generating log entries, undermining detection and post-incident analysis.
Affected Products
- CyberPanel versions prior to 2.4.4
- Hosting environments using CyberPanel for multi-tenant website management
- Deployments relying on CyberPanel access control for child domain operations
Discovery Timeline
- 2026-09-13 - CVE-2026-29812 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-29812
Vulnerability Analysis
CyberPanel manages websites and their associated child domains through the childdomains_set relation on website objects. The pre-patch code paths for listing and authorizing access to child domains lacked consistent audit logging.
An authenticated user able to invoke child domain management endpoints could add, list, or otherwise interact with child domain entries without those actions being recorded. Because the network attack vector requires only low privileges and no user interaction, any tenant with a valid CyberPanel session can exercise the affected code paths.
The absence of logging does not itself grant new privileges. It removes the evidence trail needed to identify abuse of adjacent functionality, such as unauthorized manipulation of the child domain list belonging to other administrators.
Root Cause
The root cause is missing logging around functions that read and mutate the child domains list. In plogical/acl.py, the ownership check for childDomain.master.admin.owner returned success but did not explicitly return failure or log a denial event when the ownership condition was not met. In websiteFunctions/website.py, the enumeration of childdomains_set produced the visible list without audit records for the query context.
Attack Vector
Exploitation requires network access to the CyberPanel web interface and an authenticated low-privilege account. The attacker interacts with the child domain management endpoints normally. No specialized payload is needed; the vulnerability is the silent nature of the operation rather than the operation itself.
# Patch excerpt from plogical/acl.py
else:
if childDomain.master.admin.owner == admin.pk:
return 1
+ else:
+ return 0
except:
domainName = Websites.objects.get(domain=domain)
Source: GitHub Commit 0a099b1
The patch adds an explicit return 0 when the ownership check fails, ensuring the authorization path resolves deterministically.
# Patch excerpt from websiteFunctions/website.py
childDomains = []
for web in websites:
- for child in web.childdomains_set.filter(alais=0):
- if child.domain == f'mail.{web.domain}':
- pass
- else:
- childDomains.append(child)
+ for child in web.childdomains_set.all():
+ if child.alais == 0:
+ if child.domain == f'mail.{web.domain}':
+ pass
+ else:
+ childDomains.append(child)
pagination = self.getPagination(len(childDomains), recordsToShow)
Source: GitHub Commit 0a099b1
Detection Methods for CVE-2026-29812
Indicators of Compromise
- Unexpected entries in the childdomains table that do not correlate with administrator activity
- HTTP requests to CyberPanel website management endpoints from low-privilege accounts outside normal operating hours
- Discrepancies between CyberPanel UI-visible child domains and DNS or web server configuration on the host
Detection Strategies
- Enable and centralize web server access logs for the CyberPanel interface to compensate for missing application-level logging
- Baseline the child domain inventory per tenant and alert on additions, deletions, or ownership changes
- Correlate authenticated session activity with database change events on the childdomains table
Monitoring Recommendations
- Forward CyberPanel Nginx or LiteSpeed logs to a central log platform and retain them for forensic review
- Monitor /websites/ and child domain management URL patterns for high request volumes from single accounts
- Track file system and configuration changes on virtual host directories to identify silent modifications
How to Mitigate CVE-2026-29812
Immediate Actions Required
- Upgrade CyberPanel to version 2.4.4 or later, which introduces the corrected authorization return and enumeration logic
- Audit existing CyberPanel accounts and remove unused low-privilege users that could interact with child domain endpoints
- Review current child domain records against known-good tenant configurations to identify unauthorized entries
Patch Information
The fix is included in CyberPanel 2.4.4. Review the upstream change in the GitHub Commit 0a099b1 for the exact code changes to plogical/acl.py and websiteFunctions/website.py.
Workarounds
- Restrict network access to the CyberPanel administration interface using firewall rules or VPN-only access
- Enforce web server access logging and ship logs off-host so administrative activity is recorded outside the application
- Reduce the number of accounts that can access child domain management until the upgrade is applied
# Verify installed CyberPanel version and upgrade
cat /usr/local/CyberCP/version.txt
sh <(curl https://cyberpanel.net/upgrade.sh || wget -O - https://cyberpanel.net/upgrade.sh)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
